ContrastAPI

ContrastAPI — Security Intelligence MCP Server

29 MCP tools for security research and threat intelligence. Free tier, no API key required.

Quick Setup

Add to your MCP config (Claude Desktop, Cursor, Windsurf, VS Code):

{
  "mcpServers": {
    "contrastapi": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.contrastcyber.com/mcp/"]
    }
  }
}

What's Included

• Domain Intelligence (11 tools): Full audit (report + tech + live headers), DNS, WHOIS, SSL/TLS analysis, subdomain enumeration, tech fingerprinting, WAF detection, Wayback history, live header scan, email MX + SPF/DMARC/DKIM scoring
• CVE Intelligence (4 tools): Lookup with EPSS exploit probability + CISA KEV status, search by product/severity, public exploit lookup, bulk CVE lookup (up to 50 per call)
• IP & Network (3 tools): IP lookup with reputation, ASN lookup, IP threat report (AbuseIPDB + Shodan + ASN aggregated)
• IOC / Threat Intel (4 tools): Indicator lookup (IP/domain/hash/URL auto-detect), malware hash lookup, phishing URL check, bulk IOC lookup (up to 50 per call)
• OSINT (3 tools): Disposable email check, phone validation, username OSINT across 16 platforms
• Code Security (3 tools): Secret detection, injection vulnerability check, HTTP header analysis
• Password: HIBP breach check (SHA-1 k-anonymity)

Key Features

• Weighted credits: 1 credit for simple calls, 4 for heavy orchestration (audit, threat report), N for bulk lookups — atomic enforcement
• LLM-optimized summaries: Every response includes a "summary" field for agent reasoning without parsing nested JSON
• 340K+ CVEs synced from NVD every 2 hours with EPSS + KEV enrichment
• Custom SSRF protection: httpcore backend validates all DNS-resolved IPs before connecting (catches DNS rebinding)
• C-based domain scanner: Sub-2-second full audits with SSL, DNS, headers, email security scoring

Distribution

• REST API: curl https://api.contrastcyber.com/v1/cve/CVE-2024-3094
• MCP: Remote server via mcp-remote, Streamable HTTP transport
• npm SDK: npm install contrastapi (v1.1.0, zero deps, Node 14+)
• VS Code Extension: "ContrastAPI — Security Intelligence" in Marketplace (29 commands, sidebar, context menu)
• Smithery: 98/100 quality score

Stats

• 841 tests, 36/36 smoke-test coverage
• 39+ REST endpoints
• FastAPI + C scanner, MIT licensed
• Live: https://api.contrastcyber.com
• GitHub: https://github.com/UPinar/contrastapi